CVE-2026-63278
Received Received - Intake

Environment Variable Leak in LibreOffice via Malicious URLs

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Document Foundation, The

Description
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-63278
EUVD
EUVD-2026-84357

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_document_foundation libreoffice *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves URLs that could expand environment variables or INI file values in a document. This could allow sensitive information to be sent to a remote server when the document is opened. A previous fix for a similar issue did not cover all possible ways to name the package content provider in URLs, so some malicious URLs still bypassed the check.

Detection Guidance

This vulnerability involves environment variable or INI file value expansion in URLs, potentially leaking sensitive data. Detection requires checking LibreOffice versions and examining document links for suspicious patterns. Use commands like 'libreoffice --version' to verify installed versions and inspect documents for URLs containing environment variables or INI file references.

Impact Analysis

If you open a document containing a specially crafted URL, an attacker could potentially access sensitive data from your system, such as environment variables or configuration files. This could lead to data leaks or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, which may violate compliance requirements such as GDPR or HIPAA. Organizations handling sensitive data must ensure systems are patched to prevent potential breaches and regulatory penalties.

Mitigation Strategies

Update LibreOffice to a fixed version where the package content provider is properly matched during URL checks to prevent environment variable or INI file value expansion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart